Vulnerabilities for tornado

First version without a known vulnerability: 6.5.8

Details

• GHSA-mpf4-983q-p7j42026-09-02

  Tornado: Urlencoded body parsing omits max_num_fields, so one request can stall the event loop

  Fixed in: 6.5.8

• GHSA-8423-8fgw-73vq2026-09-01

  tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)

  Fixed in: 6.5.8

• GHSA-wwv5-g3v4-889x2026-09-01

  Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie`

  Fixed in: 6.5.8

• GHSA-jhmp-mqwm-3gq82026-07-20

  Tornado: Quadratic DoS via Crafted Multipart Parameters

  Fixed in: 6.5.3

• GHSA-c98p-7wgm-6p642026-07-20

  Tornado: Quadratic DoS via Repeated Header Coalescing

  Fixed in: 6.5.3

• GHSA-pr2v-jx2c-wg9f2026-07-20

  Tornado vulnerable to Header Injection and XSS via reason argument

  Fixed in: 6.5.3

• GHSA-pw6j-qg29-8w7f2026-06-15

  Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuse

  Fixed in: 6.5.7

• GHSA-3x9g-8vmp-wqvf2026-06-15

  Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClient

  Fixed in: 6.5.6

• GHSA-mgf9-4vpg-hj562026-06-15

  tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)

  Fixed in: 6.5.6

• GHSA-cx3h-4qpv-8hc92026-06-12

  Tornado has out-of-bounds memory access via C extension

  Fixed in: 6.5.6

• GHSA-qjxf-f2mg-c6mc2026-03-12

  Tornado is vulnerable to DoS due to too many multipart parts

  Fixed in: 6.5.5

• GHSA-78cv-mqj4-43f72026-03-11

  Tornado has incomplete validation of cookie attributes

  Fixed in: 6.5.5

• GHSA-7cx3-6m66-7c5m2025-05-16

  Tornado vulnerable to excessive logging caused by malformed multipart form data

  Fixed in: 6.5

• GHSA-8w49-h785-mj3c2024-11-22

  Tornado has an HTTP cookie parsing DoS vulnerability

  Fixed in: 6.4.2

• GHSA-w235-7p84-xx572024-06-06

  Tornado has a CRLF injection in CurlAsyncHTTPClient headers

  Fixed in: 6.4.1

• GHSA-753j-mpmx-qq6g2024-06-06

  Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in tornado

  Fixed in: 6.4.1

• GHSA-qppv-j76h-2rpx2023-08-14

  Tornado vulnerable to HTTP request smuggling via improper parsing of `Content-Length` fields and chunk lengths

  Fixed in: 6.3.3

• GHSA-hj3f-6gcp-jg8j2023-05-25

  Open redirect in Tornado

  Fixed in: 6.3.2

• GHSA-8vpw-mgpf-mpvv2022-05-17

  Tornado XSRF cookie allows side-channel attack against TLS (BREACH attack)

  Fixed in: 3.2.2, 1c36307463b1e8affae100bf9386948e6c1b2308

• GHSA-f7fv-v9rh-prvc2022-05-17

  Tornado CRLF injection vulnerability

  Fixed in: 2.2.1